İçeriğe atla
Noroxi

Yayın tarihine göre

Aralık 2011: sömürülen ve yeni ciddi CVE kayıtları

53 kayıt · 2 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2011-4161
    44Planlayın

    The default configuration of the HP CM8060 Color MFP with Edgeline; Color LaserJet 3xxx, 4xxx, 5550, 9500, CMxxxx, CPxxxx, and Enterprise CP

    KritikCVSS 10,0İstismar yokEPSS %13

    hp · color laserjet 30001 Ara 2011

  • CVE-2011-4034
    41Planlayın

    Buffer overflow in the Steema TeeChart ActiveX control, as used in Schneider Electric Vijeo Historian 4.30 and earlier, CitectHistorian 4.30

    KritikCVSS 9,3SilahlaştırılmışEPSS %13

    schneider-electric · vijeo historian2 Ara 2011

  • CVE-2011-4051
    61Bu hafta

    CEServer.exe in the CEServer component in the Remote Agent module in InduSoft Web Studio 6.1 and 7.0 does not require authentication, which

    KritikCVSS 10,0SilahlaştırılmışEPSS %69

    indusoft · web studio5 Ara 2011

  • CVE-2011-4130
    40Planlayın

    Use-after-free vulnerability in the Response API in ProFTPD before 1.3.3g allows remote authenticated users to execute arbitrary code via ve

    KritikCVSS 9,0İstismar yokEPSS %12

    proftpd · proftpd6 Ara 2011

  • CVE-2002-2435
    21İzleyin

    The Cascading Style Sheets (CSS) implementation in Microsoft Internet Explorer 8.0 and earlier does not properly handle the :visited pseudo-

    OrtaCVSS 4,3İstismar yokEPSS %13

    microsoft · ie7 Ara 2011

  • CVE-2010-5071
    24İzleyin

    The JavaScript implementation in Microsoft Internet Explorer 8.0 and earlier does not properly restrict the set of values contained in the o

    OrtaCVSS 5,0İstismar yokEPSS %12

    microsoft · ie7 Ara 2011

  • CVE-2011-2462
    96Hemen

    Unspecified vulnerability in the U3D component in Adobe Reader and Acrobat 10.1.1 and earlier on Windows and Mac OS X, and Adobe Reader 9.x

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %88

    adobe · acrobat7 Ara 2011

  • CVE-2011-2653
    62Bu hafta

    Directory traversal vulnerability in the rtrlet component in Novell ZENworks Asset Management (ZAM) 7.5 allows remote attackers to execute a

    KritikCVSS 10,0SilahlaştırılmışEPSS %72

    novell · zenworks asset management8 Ara 2011

  • CVE-2011-4539
    25İzleyin

    dhcpd in ISC DHCP 4.x before 4.2.3-P1 and 4.1-ESV before 4.1-ESV-R4 does not properly handle regular expressions in dhcpd.conf, which allows

    OrtaCVSS 5,0İstismar yokEPSS %15

    isc · dhcp8 Ara 2011

  • CVE-2011-1508
    41Planlayın

    Microsoft Publisher 2003 SP3, and 2007 SP2 and SP3, does not properly manage memory allocations for function pointers, which allows user-ass

    KritikCVSS 9,3İstismar yokEPSS %13

    microsoft · publisher13 Ara 2011

  • CVE-2011-1983
    44Planlayın

    Use-after-free vulnerability in Microsoft Office 2007 SP2 and SP3, Office 2010 Gold and SP1, and Office for Mac 2011 allows remote attackers

    KritikCVSS 9,3İstismar yokEPSS %22

    microsoft · office13 Ara 2011

  • CVE-2011-1992
    23İzleyin

    The XSS Filter in Microsoft Internet Explorer 8 allows remote attackers to read content from a different (1) domain or (2) zone via a "trial

    OrtaCVSS 4,3İstismar yokEPSS %18

    microsoft · internet explorer13 Ara 2011

  • CVE-2011-2019
    40Planlayın

    Untrusted search path vulnerability in Microsoft Internet Explorer 9 on Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1 allows

    KritikCVSS 9,3İstismar yokEPSS %11

    microsoft · internet explorer13 Ara 2011

  • CVE-2011-3396
    42Planlayın

    Untrusted search path vulnerability in Microsoft PowerPoint 2007 SP2 and 2010 allows local users to gain privileges via a Trojan horse DLL i

    KritikCVSS 9,3İstismar yokEPSS %18

    microsoft · powerpoint13 Ara 2011

  • CVE-2011-3397
    43Planlayın

    The Microsoft Time component in DATIME.DLL in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows remote attackers to execute arbitr

    KritikCVSS 9,3İstismar yokEPSS %19

    microsoft · windows server 200313 Ara 2011

  • CVE-2011-3400
    58Planlayın

    Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 do not properly handle OLE objects in memory, which allows remote attackers to execute

    KritikCVSS 9,3SilahlaştırılmışEPSS %71

    microsoft · windows server 200313 Ara 2011

  • CVE-2011-3401
    43Planlayın

    ENCDEC.DLL in Windows Media Player and Media Center in Microsoft Windows XP SP2 and SP3, Windows Vista SP2, and Windows 7 Gold and SP1 allow

    KritikCVSS 9,3İstismar yokEPSS %20

    microsoft · windows 713 Ara 2011

  • CVE-2011-3403
    43Planlayın

    Microsoft Excel 2003 SP3 and Office 2004 for Mac do not properly handle objects in memory, which allows remote attackers to execute arbitrar

    KritikCVSS 9,3İstismar yokEPSS %20

    microsoft · excel13 Ara 2011

  • CVE-2011-3404
    21İzleyin

    Microsoft Internet Explorer 6 through 9 does not properly use the Content-Disposition HTTP header to control rendering of the HTTP response

    OrtaCVSS 4,3İstismar yokEPSS %13

    microsoft · internet explorer13 Ara 2011

  • CVE-2011-3406
    42Planlayın

    Buffer overflow in Active Directory, Active Directory Application Mode (ADAM), and Active Directory Lightweight Directory Service (AD LDS) i

    YüksekCVSS 8,8İstismar yokEPSS %23

    microsoft · windows 713 Ara 2011

  • CVE-2011-3410
    46Planlayın

    Array index error in Microsoft Publisher 2003 SP3, and 2007 SP2 and SP3, allows remote attackers to execute arbitrary code via a crafted Pub

    KritikCVSS 9,3İstismar yokEPSS %28

    microsoft · publisher13 Ara 2011

  • CVE-2011-3411
    45Planlayın

    Microsoft Publisher 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Publisher file that leverages incorrect handlin

    KritikCVSS 9,3İstismar yokEPSS %27

    microsoft · publisher13 Ara 2011

  • CVE-2011-3412
    45Planlayın

    Microsoft Publisher 2003 SP3, and 2007 SP2 and SP3, allows remote attackers to execute arbitrary code via a crafted Publisher file that leve

    KritikCVSS 9,3İstismar yokEPSS %26

    microsoft · publisher13 Ara 2011

  • CVE-2011-3413
    43Planlayın

    Microsoft PowerPoint 2007 SP2; Office 2008 for Mac; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP2; and Pow

    KritikCVSS 9,3İstismar yokEPSS %19

    microsoft · office13 Ara 2011

  • CVE-2011-4804
    26İzleyin

    Directory traversal vulnerability in the obSuggest (com_obsuggest) component before 1.8 for Joomla! allows remote attackers to read arbitrar

    OrtaCVSS 5,0Kavram kanıtıEPSS %20

    joomla · joomla\!13 Ara 2011

  • CVE-2011-4516
    30İzleyin

    Heap-based buffer overflow in the jpc_cox_getcompparms function in libjasper/jpc/jpc_cs.c in JasPer 1.900.1 allows remote attackers to execu

    OrtaCVSS 6,8İstismar yokEPSS %10

    jasper project · jasper14 Ara 2011

  • CVE-2011-4517
    30İzleyin

    The jpc_crg_getparms function in libjasper/jpc/jpc_cs.c in JasPer 1.900.1 uses an incorrect data type during a certain size calculation, whi

    OrtaCVSS 6,8İstismar yokEPSS %10

    jasper project · jasper14 Ara 2011

  • CVE-2011-4825
    42Planlayın

    Static code injection vulnerability in inc/function.base.php in Ajax File and Image Manager before 1.1, as used in tinymce before 1.4.2, php

    YüksekCVSS 7,5SilahlaştırılmışEPSS %39

    tinymce · tinymce14 Ara 2011

  • CVE-2011-4828
    50Planlayın

    Unrestricted file upload vulnerability in includes/inline_image_upload.php in AutoSec Tools V-CMS 1.0 allows remote attackers to execute arb

    YüksekCVSS 7,5SilahlaştırılmışEPSS %65

    autosectools · v-cms14 Ara 2011

  • CVE-2011-4723
    53Planlayın

    The D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive information via unspecifi

    OrtaCVSS 5,7KEVSilahlaştırılmışEPSS %3

    dlink · dir-300 firmware20 Ara 2011

  • CVE-2011-3658
    51Planlayın

    The SVG implementation in Mozilla Firefox 8.0, Thunderbird 8.0, and SeaMonkey 2.5 does not properly interact with DOMAttrModified event hand

    YüksekCVSS 7,5SilahlaştırılmışEPSS %69

    mozilla · firefox21 Ara 2011

  • CVE-2011-4453
    46Planlayın

    The PageListSort function in scripts/pagelist.php in PmWiki 2.x before 2.2.35 allows remote attackers to execute arbitrary code via PHP sequ

    YüksekCVSS 7,5SilahlaştırılmışEPSS %51

    pmwiki · pmwiki22 Ara 2011

  • CVE-2011-4362
    26İzleyin

    Integer signedness error in the base64_decode function in the HTTP authentication functionality (http_auth.c) in lighttpd 1.4 before 1.4.30

    OrtaCVSS 5,0Kavram kanıtıEPSS %21

    lighttpd · lighttpd24 Ara 2011

  • CVE-2009-5109
    47Planlayın

    Stack-based buffer overflow in Mini-Stream Ripper 3.0.1.1 allows remote attackers to execute arbitrary code via a long entry in a .pls file.

    KritikCVSS 9,3SilahlaştırılmışEPSS %32

    mini-stream · ripper24 Ara 2011

  • CVE-2010-5081
    46Planlayın

    Stack-based buffer overflow in Mini-Stream RM-MP3 Converter 3.1.2.1 allows remote attackers to execute arbitrary code via a long URL in a .p

    KritikCVSS 9,3SilahlaştırılmışEPSS %30

    mini-stream · rm-mp3 converter24 Ara 2011

  • CVE-2011-4862
    69Bu hafta

    Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and

    KritikCVSS 10,0SilahlaştırılmışEPSS %95

    mit · krb5-appl24 Ara 2011

  • CVE-2011-5001
    59Planlayın

    Stack-based buffer overflow in the CGenericScheduler::AddTask function in cmdHandlerRedAlertController.dll in CmdProcessor.exe in Trend Micr

    KritikCVSS 10,0SilahlaştırılmışEPSS %64

    trend micro · control manager24 Ara 2011

  • CVE-2011-5003
    59Planlayın

    Stack-based buffer overflow in the Phonetic Indexer (AvidPhoneticIndexer.exe) in Avid Media Composer 5.5.3 and earlier allows remote attacke

    KritikCVSS 10,0SilahlaştırılmışEPSS %62

    avid · media composer24 Ara 2011

  • CVE-2011-5007
    62Bu hafta

    Stack-based buffer overflow in the CmpWebServer component in 3S CoDeSys 3.4 SP4 Patch 2 and earlier, as used on the ABB AC500 PLC and possib

    KritikCVSS 10,0SilahlaştırılmışEPSS %72

    3ssoftware · codesys24 Ara 2011

  • CVE-2011-5009
    23İzleyin

    The CmpWebServer.dll module in the Control service in 3S CoDeSys 3.4 SP4 Patch 2 allows remote attackers to cause a denial of service (NULL

    OrtaCVSS 5,0Kavram kanıtıEPSS %10

    3ssoftware · codesys24 Ara 2011

  • CVE-2011-5010
    60Bu hafta

    apps/a3/cfg_ethping.cgi in the Ctek SkyRouter 4200 and 4300 allows remote attackers to execute arbitrary commands via shell metacharacters i

    KritikCVSS 10,0SilahlaştırılmışEPSS %65

    ctekproducts · skyrouter24 Ara 2011

  • CVE-2011-4050
    40Planlayın

    Buffer overflow in 7-Technologies (7T) Interactive Graphical SCADA System (IGSS) 9.0.0.11200 allows remote attackers to cause a denial of se

    OrtaCVSS 5,0SilahlaştırılmışEPSS %20

    7t · igss27 Ara 2011

  • CVE-2011-4166
    48Planlayın

    Directory traversal vulnerability in the MPAUploader.Uploader.1.UploadFiles method in HP Managed Printing Administration before 2.6.4 allows

    YüksekCVSS 7,5SilahlaştırılmışEPSS %58

    hp · managed printing administration27 Ara 2011

  • CVE-2007-6750
    41Planlayın

    The Apache HTTP Server 1.x and 2.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demons

    OrtaCVSS 5,0SilahlaştırılmışEPSS %70

    apache · http server27 Ara 2011

  • CVE-2011-3414
    48Planlayın

    The CaseInsensitiveHashProvider.getHashCode function in the HashTable implementation in the ASP.NET subsystem in Microsoft .NET Framework 1.

    YüksekCVSS 7,8İstismar yokEPSS %57

    microsoft · windows 729 Ara 2011

  • CVE-2011-3415
    34İzleyin

    Open redirect vulnerability in the Forms Authentication feature in the ASP.NET subsystem in Microsoft .NET Framework 2.0 SP2, 3.5 SP1, 3.5.1

    OrtaCVSS 6,8İstismar yokEPSS %22

    microsoft · windows 729 Ara 2011

  • CVE-2011-3416
    47Planlayın

    The Forms Authentication feature in the ASP.NET subsystem in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5 SP1, 3.5.1, and 4.0 allows remot

    YüksekCVSS 8,5İstismar yokEPSS %43

    microsoft · windows 729 Ara 2011

  • CVE-2011-3417
    47Planlayın

    The Forms Authentication feature in the ASP.NET subsystem in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5 SP1, 3.5.1, and 4.0, when slidin

    KritikCVSS 9,3İstismar yokEPSS %34

    microsoft · windows 729 Ara 2011

  • CVE-2011-4885
    45Planlayın

    PHP before 5.3.9 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allo

    OrtaCVSS 5,0SilahlaştırılmışEPSS %83

    php · php29 Ara 2011

  • CVE-2011-5034
    55Planlayın

    Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predic

    YüksekCVSS 7,8SilahlaştırılmışEPSS %80

    apache · geronimo29 Ara 2011

  • CVE-2011-5035
    40Planlayın

    Oracle Glassfish 2.1.1, 3.0.1, and 3.1.1, as used in Communications Server 2.0, Sun Java System Application Server 8.1 and 8.2, and possibly

    OrtaCVSS 5,0SilahlaştırılmışEPSS %68

    oracle · glassfish server29 Ara 2011

  • CVE-2011-5046
    51Planlayın

    The Graphics Device Interface (GDI) in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, W

    KritikCVSS 9,3Kavram kanıtıEPSS %45

    microsoft · windows 730 Ara 2011

  • CVE-2011-4620
    41Planlayın

    Buffer overflow in the ulSetError function in util/ulError.cxx in PLIB 1.8.5, as used in TORCS 1.3.1 and other products, allows user-assiste

    KritikCVSS 9,3Kavram kanıtıEPSS %12

    steve j baker · plib30 Ara 2011